I have an endpoint API for a POST request in a multi-tenant application, let's say it is for a Payment, where we have to store these fields:

  • tenant_id (this is the account owner)
  • amount
  • date
  • payer_id -- the user that makes the payment
  • user_id -- another user that has to be attached to this payment
  • category_id -- a category payment that the user can select from a dropdown menu

The JWT can tell me the tenant that is making the request and I can trust it, so the tenant_id is filled by the server-side. But every other field is going to be stored from the POST request.

Should I check the ownership of every *_id field? In this case, I should make 3 queries to the database, a process like this:

  • Get the row payer_id from the users table.
  • Check if row->tenant_id == tenant_id
  • If yes, payer_id is a resource owned by this tenant, if no return an error.

Repeat for user_id and category_id ... end every other *_id field.

My question is about good practice.

1 Answer 1


In a multi-tenant application, you will need to ensure that data from different tenants isn't mixed.

Checking ownership on each request is a reasonable solution, but as you noticed, there's some overhead associated with it. You may be able to keep the costs of these checks low by putting them into the database using stored procedures or check constraints, or by caching them (caveat: https://martinfowler.com/bliki/TwoHardThings.html).

On the other hand, I wouldn't be too concerned about the performance hit. If your database doesn't check the existence of ids using foreign key or check constraints, you will need to do an existence check anyway. Including the tenant id in such a check doesn't make a big difference.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.